dsh-coding-subscription-oauth 0.6.4 → 0.7.0

package/lib/index.js

@@ -14906,7 +14906,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "node_modules/.pnpm/undici@7.29.0/node_modules/undici/lib/interceptor/dns.js"(exports, module) {
     "use strict";
-    var { isIP: isIP2 } = __require("node:net");
+    var { isIP: isIP3 } = __require("node:net");
     var { lookup } = __require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
@@ -15312,7 +15312,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP3(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -25609,7 +25609,7 @@ import { dirname as dirname6, join as join8 } from "node:path";
 import { assertUsableApiKey, RetryPolicySchema } from "@deepseek-ai/dsh-llm";
 import z2 from "@deepseek-ai/schemastery";
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/proxy.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/proxy.js
 var import_undici = __toESM(require_undici(), 1);
 var DEFAULT_PROXIED_HOSTS = [
   "auth.x.ai",
@@ -25744,7 +25744,7 @@ function grokBuildProxyInEffect() {
   return codingOAuthProxyInEffect();
 }
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/route-registration.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/route-registration.js
 function releaseRegistrationsSynchronously(disposers) {
   for (const dispose of [...disposers].reverse()) {
     try {
@@ -25780,7 +25780,7 @@ function setupAtomicallySynchronously(registry, setup) {
   return onceSynchronously(disposers);
 }
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/ids.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/ids.js
 var XAI_PI_PROVIDER = "xai";
 var CODEX_PI_PROVIDER = "openai-codex";
 var KIMI_PI_PROVIDER = "kimi-coding";
@@ -25808,7 +25808,7 @@ var CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME = ".claude-code-oauth-models.json";
 var DEFAULT_GROK_BUILD_MODEL = "grok-4.6";
 var GROK_BUILD_STREAM_IDLE_TIMEOUT_MS = 3e5;
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/state-contract.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/state-contract.js
 var CAPABILITY_SETTINGS_NAMESPACE = "coding-subscription-oauth";
 var GATEWAY_KEY_FILENAME = ".coding-oauth-gateway.json";
 var IMAGINE_MEDIA_STORE_DIRNAME = ".dsh-coding-subscription-oauth-media";
@@ -25861,7 +25861,115 @@ var CODING_OAUTH_MANAGEMENT_PATHS = Object.freeze([
   GATEWAY_ROTATE_PATH
 ]);
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/index.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/http-json.js
+var JSON_BODY_LIMIT_BYTES = 64 * 1024;
+var JsonRequestError = class extends Error {
+  statusCode;
+  constructor(statusCode, message) {
+    super(message);
+    this.name = "JsonRequestError";
+    this.statusCode = statusCode;
+  }
+};
+function declaredLength(request) {
+  const value = request.headers["content-length"];
+  if (typeof value !== "string" || !/^\d+$/u.test(value))
+    return void 0;
+  const length = Number(value);
+  return Number.isSafeInteger(length) ? length : void 0;
+}
+function readJsonRequest(request, limit = JSON_BODY_LIMIT_BYTES) {
+  const length = declaredLength(request);
+  if (length !== void 0 && length > limit) {
+    request.resume();
+    return Promise.reject(new JsonRequestError(413, "request body is too large"));
+  }
+  return new Promise((resolve8, reject) => {
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    const cleanup = () => {
+      request.removeListener("data", onData);
+      request.removeListener("end", onEnd);
+      request.removeListener("error", onError);
+      request.removeListener("aborted", onAborted);
+    };
+    const fail = (error) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      request.resume();
+      reject(error);
+    };
+    const onData = (value) => {
+      if (settled)
+        return;
+      const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+      size += chunk.byteLength;
+      if (size > limit) {
+        fail(new JsonRequestError(413, "request body is too large"));
+        return;
+      }
+      chunks.push(chunk);
+    };
+    const onEnd = () => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      const text = Buffer.concat(chunks, size).toString("utf8").trim();
+      if (text.length === 0) {
+        resolve8({});
+        return;
+      }
+      try {
+        resolve8(JSON.parse(text));
+      } catch {
+        reject(new JsonRequestError(400, "request body must contain valid JSON"));
+      }
+    };
+    const onError = () => fail(new JsonRequestError(400, "request body could not be read"));
+    const onAborted = () => fail(new JsonRequestError(400, "request body was aborted"));
+    request.on("data", onData);
+    request.once("end", onEnd);
+    request.once("error", onError);
+    request.once("aborted", onAborted);
+  });
+}
+function requestErrorStatus(error, fallback) {
+  return error instanceof JsonRequestError ? error.statusCode : fallback;
+}
+
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/grok-errors.js
+var XAI_CAPACITY = /\b(?:at\s+capacity|high\s+demand|priority\s+processing|overloaded)\b/i;
+function isXaiCapacityError(detail) {
+  return XAI_CAPACITY.test(detail);
+}
+function remapXaiCapacityFailure(failure) {
+  if (!isXaiCapacityError(failure.message))
+    return failure;
+  return { ...failure, code: "RATE_LIMIT" };
+}
+
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/kimi-errors.js
+import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError } from "@deepseek-ai/dsh-llm";
+var KIMI_CONTEXT_CAPACITY = /\bsupports only\s+\d+\s*k\s+context\b/i;
+function isMisclassifiedContextWindowError(detail) {
+  return isContextWindowExceededError(detail) || KIMI_CONTEXT_CAPACITY.test(detail);
+}
+function remapAuthFailureIfContextOverflow(failure) {
+  if (failure.code !== "AUTH" || !isMisclassifiedContextWindowError(failure.message))
+    return failure;
+  return { ...failure, code: CONTEXT_WINDOW_EXCEEDED_CODE };
+}
+
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/gateway-protocol.js
+function isThinkingLevel(value) {
+  return value === "off" || value === "minimal" || value === "low" || value === "medium" || value === "high" || value === "xhigh" || value === "max";
+}
+
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/index.js
 var CODING_OAUTH_CORE_ABI = "dsh-coding-oauth-core/v1";
 var STORE_SYMBOL = /* @__PURE__ */ Symbol.for("dsh.coding-oauth-core.runtime-store");
 function resolveCodingOAuthScope(context) {
@@ -26068,29 +26176,6 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 
 // src/alias-adapter.ts
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
-
-// src/grok-errors.ts
-var XAI_CAPACITY = /\b(?:at\s+capacity|high\s+demand|priority\s+processing|overloaded)\b/i;
-function isXaiCapacityError(detail) {
-  return XAI_CAPACITY.test(detail);
-}
-function remapXaiCapacityFailure(failure) {
-  if (!isXaiCapacityError(failure.message)) return failure;
-  return { ...failure, code: "RATE_LIMIT" };
-}
-
-// src/kimi-errors.ts
-import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError } from "@deepseek-ai/dsh-llm";
-var KIMI_CONTEXT_CAPACITY = /\bsupports only\s+\d+\s*k\s+context\b/i;
-function isMisclassifiedContextWindowError(detail) {
-  return isContextWindowExceededError(detail) || KIMI_CONTEXT_CAPACITY.test(detail);
-}
-function remapAuthFailureIfContextOverflow(failure) {
-  if (failure.code !== "AUTH" || !isMisclassifiedContextWindowError(failure.message)) return failure;
-  return { ...failure, code: CONTEXT_WINDOW_EXCEEDED_CODE };
-}
-
-// src/alias-adapter.ts
 function normalizeReplayForRoute(message, route2, nativeReplayProvider) {
   if (message.role !== "assistant" || message.source.kind !== "model") return message;
   if (message.source.provider !== route2) {
@@ -26174,6 +26259,11 @@ var AliasLlmAdapter = class extends LlmAdapter {
   }
 };
 
+// src/ids.ts
+var CODING_OAUTH_API_BASE = "/plugins/dsh-grok-build";
+var CODING_OAUTH_ACCOUNTS_SET_ACTIVE_PATH = `${CODING_OAUTH_API_BASE}/oauth/accounts/set-active`;
+var CODING_OAUTH_ACCOUNTS_REMOVE_PATH = `${CODING_OAUTH_API_BASE}/oauth/accounts/remove`;
+
 // src/provider.ts
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.lazy";
@@ -27304,6 +27394,7 @@ async function importGrokAuth(store, filename = grokAuthPath()) {
 }
 
 // src/store.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdir, rm } from "node:fs/promises";
 import { dirname, join as join3, resolve as resolve3 } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
@@ -28061,25 +28152,17 @@ function nonEmptyString2(value) {
 }
 
 // src/store.ts
-var AUTH_FORMAT_VERSION = 1;
-function parseDocument(text, filename, label) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw new Error(`${label}: ${filename} is not valid JSON`);
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${label}: ${filename} must contain an object`);
-  }
-  const document = value;
-  if (document["version"] !== AUTH_FORMAT_VERSION) {
-    throw new Error(`${label}: ${filename} has unsupported auth format version ${String(document["version"])}`);
-  }
-  if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) {
-    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
-  }
-  const raw = document["credential"];
+var AUTH_FORMAT_VERSION = 2;
+var AUTH_FORMAT_VERSION_V1 = 1;
+var OAUTH_MAX_ACCOUNTS = 8;
+var MAX_ACCOUNTS = OAUTH_MAX_ACCOUNTS;
+var LEGACY_ACCOUNT_ID = "legacy";
+var ACCOUNT_ID_PATTERN = /^[A-Za-z0-9._:@+-]+$/u;
+var UNCHANGED = /* @__PURE__ */ Symbol("unchanged");
+function isValidAccountId(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 128 && ACCOUNT_ID_PATTERN.test(value);
+}
+function parseOAuthCredential(raw, filename, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error(`${label}: ${filename} credential must be an object`);
   }
@@ -28088,23 +28171,178 @@ function parseDocument(text, filename, label) {
   if (Object.keys(credential).some((key) => !allowed.has(key))) {
     throw new Error(`${label}: ${filename} credential contains an unknown field`);
   }
-  if (credential["type"] !== "oauth") throw new Error(`${label}: ${filename} credential type must be oauth`);
+  if (credential.type !== "oauth") throw new Error(`${label}: ${filename} credential type must be oauth`);
   for (const key of ["access", "refresh"]) {
     if (typeof credential[key] !== "string" || credential[key].length === 0) {
       throw new Error(`${label}: ${filename} credential ${key} must be a non-empty string`);
     }
   }
-  if (credential["accountId"] !== void 0 && (typeof credential["accountId"] !== "string" || credential["accountId"].length === 0)) {
+  if (credential.accountId !== void 0 && (typeof credential.accountId !== "string" || credential.accountId.length === 0)) {
     throw new Error(`${label}: ${filename} credential accountId must be a non-empty string when present`);
   }
-  if (typeof credential["expires"] !== "number" || !Number.isFinite(credential["expires"]) || credential["expires"] <= 0) {
+  if (typeof credential.expires !== "number" || !Number.isFinite(credential.expires) || credential.expires <= 0) {
     throw new Error(`${label}: ${filename} credential expires must be a positive finite number`);
   }
-  return { version: AUTH_FORMAT_VERSION, credential };
+  return credential;
+}
+function parseAccountRecord(raw, filename, label, index) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}] must be an object`);
+  }
+  const record2 = raw;
+  const allowed = /* @__PURE__ */ new Set(["id", "label", "credential", "createdAt"]);
+  if (Object.keys(record2).some((key) => !allowed.has(key))) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}] contains an unknown field`);
+  }
+  if (!isValidAccountId(record2.id)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].id is not a valid account id`);
+  }
+  if (record2.label !== void 0 && (typeof record2.label !== "string" || record2.label.length === 0)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].label must be a non-empty string when present`);
+  }
+  if (typeof record2.createdAt !== "number" || !Number.isFinite(record2.createdAt) || record2.createdAt <= 0) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].createdAt must be a positive finite number`);
+  }
+  const credential = parseOAuthCredential(record2.credential, filename, label);
+  return {
+    id: record2.id,
+    ...record2.label === void 0 ? {} : { label: record2.label },
+    credential,
+    createdAt: record2.createdAt
+  };
+}
+function parseDocumentV2(document, filename, label) {
+  if (Object.keys(document).some((key) => key !== "version" && key !== "activeAccountId" && key !== "accounts")) {
+    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
+  }
+  if (!isValidAccountId(document.activeAccountId)) {
+    throw new Error(`${label}: ${filename} activeAccountId is not a valid account id`);
+  }
+  if (!Array.isArray(document.accounts)) {
+    throw new Error(`${label}: ${filename} accounts must be an array`);
+  }
+  if (document.accounts.length < 1 || document.accounts.length > MAX_ACCOUNTS) {
+    throw new Error(`${label}: ${filename} accounts must contain between 1 and ${String(MAX_ACCOUNTS)} entries`);
+  }
+  const accounts = document.accounts.map((entry, index) => parseAccountRecord(entry, filename, label, index));
+  const ids = /* @__PURE__ */ new Set();
+  for (const account of accounts) {
+    if (ids.has(account.id)) {
+      throw new Error(`${label}: ${filename} accounts contains a duplicate id`);
+    }
+    ids.add(account.id);
+  }
+  if (!ids.has(document.activeAccountId)) {
+    throw new Error(`${label}: ${filename} activeAccountId does not match any account`);
+  }
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: document.activeAccountId,
+    accounts
+  };
+}
+function parseDocumentV1(document, filename, label) {
+  if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) {
+    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
+  }
+  return parseOAuthCredential(document.credential, filename, label);
+}
+function parseDocument(text, filename, label) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${label}: ${filename} is not valid JSON`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label}: ${filename} must contain an object`);
+  }
+  const document = value;
+  if (document.version === AUTH_FORMAT_VERSION_V1) {
+    return { document: migrateV1Credential(parseDocumentV1(document, filename, label)), migratedFromV1: true };
+  }
+  if (document.version === AUTH_FORMAT_VERSION) {
+    return { document: parseDocumentV2(document, filename, label), migratedFromV1: false };
+  }
+  throw new Error(`${label}: ${filename} has unsupported auth format version ${String(document.version)}`);
+}
+function migrateV1Credential(credential) {
+  const accountIdField = credential.accountId;
+  const id = isValidAccountId(accountIdField) ? accountIdField : LEGACY_ACCOUNT_ID;
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: id,
+    accounts: [
+      {
+        id,
+        credential: cloneCredential2(credential),
+        createdAt: Date.now()
+      }
+    ]
+  };
 }
 function cloneCredential2(credential) {
   return structuredClone(credential);
 }
+function cloneDocument(document) {
+  return structuredClone(document);
+}
+function activeCredential(document) {
+  const active = document.accounts.find((account) => account.id === document.activeAccountId);
+  if (active === void 0) {
+    throw new Error("active account missing from document");
+  }
+  return cloneCredential2(active.credential);
+}
+function resolveAccountIdForCredential(credential) {
+  const accountIdField = credential.accountId;
+  if (isValidAccountId(accountIdField)) return accountIdField;
+  return `acct-${randomBytes2(8).toString("hex")}`;
+}
+function documentFromCredential(credential) {
+  const id = resolveAccountIdForCredential(credential);
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: id,
+    accounts: [
+      {
+        id,
+        credential: cloneCredential2(credential),
+        createdAt: Date.now()
+      }
+    ]
+  };
+}
+function withUpdatedActiveCredential(document, credential) {
+  const accounts = document.accounts.map(
+    (account) => account.id === document.activeAccountId ? { ...account, credential: cloneCredential2(credential) } : cloneAccount(account)
+  );
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: document.activeAccountId,
+    accounts
+  };
+}
+function cloneAccount(account) {
+  return {
+    id: account.id,
+    ...account.label === void 0 ? {} : { label: account.label },
+    credential: cloneCredential2(account.credential),
+    createdAt: account.createdAt
+  };
+}
+function summarizeAccount(account) {
+  const accountIdField = account.credential.accountId;
+  return {
+    id: account.id,
+    ...account.label === void 0 ? {} : { label: account.label },
+    expires: account.credential.expires,
+    ...typeof accountIdField === "string" && accountIdField.length > 0 ? { accountId: accountIdField } : {}
+  };
+}
+function validatedDocument(document, filename, label) {
+  return parseDocument(JSON.stringify(document), filename, label).document;
+}
 function oauthCredentialPath(basename, dshHome) {
   if (basename.length === 0 || basename.length > 128 || basename === "." || basename === ".." || !/^\.?[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(basename)) {
     throw new TypeError("OAuth credential basename must be a safe local filename");
@@ -28123,6 +28361,7 @@ var OAuthCredentialFileStore = class {
   providerId;
   label;
   filename;
+  loginPersist;
   async readCurrent() {
     return this.loadCurrent({ allowUnreadable: false });
   }
@@ -28132,6 +28371,10 @@ var OAuthCredentialFileStore = class {
    * Unsafe/symlink/wrong-owner/too-large files still throw.
    */
   async loadCurrent(options) {
+    const loaded = await this.loadDocument({ allowUnreadable: options.allowUnreadable, persistMigration: false });
+    return loaded === void 0 ? void 0 : activeCredential(loaded.document);
+  }
+  async loadDocument(options) {
     let text;
     try {
       text = (await readHardenedOAuthSourceFile(this.filename)).text;
@@ -28143,7 +28386,11 @@ var OAuthCredentialFileStore = class {
       throw error;
     }
     try {
-      return cloneCredential2(parseDocument(text, this.filename, this.label).credential);
+      const parsed = parseDocument(text, this.filename, this.label);
+      if (options.persistMigration && parsed.migratedFromV1) {
+        await this.writeDocument(parsed.document);
+      }
+      return parsed;
     } catch (error) {
       if (options.allowUnreadable) return void 0;
       throw error;
@@ -28161,6 +28408,91 @@ var OAuthCredentialFileStore = class {
       throw error;
     }
   }
+  async writeDocument(document) {
+    const validated = validatedDocument(document, this.filename, this.label);
+    await this.assertDestinationReplaceable();
+    await writeFileAtomic(this.filename, `${JSON.stringify(validated, null, 2)}
+`, {
+      mode: 384,
+      dirMode: 448
+    });
+    return cloneDocument(validated);
+  }
+  nextDocumentAfterLogin(current, credential, options) {
+    const parsed = parseOAuthCredential(credential, this.filename, this.label);
+    if (options.mode === "overwrite-active") {
+      if (current === void 0) return documentFromCredential(parsed);
+      if (options.confirmOverwrite !== true) {
+        throw new Error(`${this.label}: confirmOverwrite is required to replace the active account`);
+      }
+      return withUpdatedActiveCredential(current, parsed);
+    }
+    const id = resolveAccountIdForCredential(parsed);
+    if (current === void 0) {
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: id,
+        accounts: [
+          {
+            id,
+            credential: cloneCredential2(parsed),
+            createdAt: Date.now()
+          }
+        ]
+      };
+    }
+    const existingIndex = current.accounts.findIndex((account) => account.id === id);
+    if (existingIndex < 0 && current.accounts.length >= MAX_ACCOUNTS) {
+      throw new Error(`${this.label}: at most ${String(MAX_ACCOUNTS)} accounts may be stored`);
+    }
+    const accounts = current.accounts.map(cloneAccount);
+    if (existingIndex >= 0) {
+      const existing = accounts[existingIndex];
+      if (existing === void 0) {
+        throw new Error(`${this.label}: account "${id}" is not stored`);
+      }
+      accounts[existingIndex] = {
+        id,
+        ...existing.label === void 0 ? {} : { label: existing.label },
+        credential: cloneCredential2(parsed),
+        createdAt: existing.createdAt
+      };
+    } else {
+      accounts.push({
+        id,
+        credential: cloneCredential2(parsed),
+        createdAt: Date.now()
+      });
+    }
+    return {
+      version: AUTH_FORMAT_VERSION,
+      activeAccountId: id,
+      accounts
+    };
+  }
+  async mutateDocument(options, fn) {
+    await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
+    return withFileLock(this.filename, async () => {
+      const loaded = await this.loadDocument({
+        allowUnreadable: options.allowUnreadable,
+        persistMigration: false
+      });
+      const current = loaded === void 0 ? void 0 : loaded.document;
+      const migratedFromV1 = loaded?.migratedFromV1 === true;
+      const next = await fn(current === void 0 ? void 0 : cloneDocument(current));
+      if (next === UNCHANGED) {
+        if (migratedFromV1 && current !== void 0) {
+          return this.writeDocument(current);
+        }
+        return current === void 0 ? void 0 : cloneDocument(current);
+      }
+      if (next === void 0) {
+        await rm(this.filename, { force: true });
+        return void 0;
+      }
+      return this.writeDocument(next);
+    });
+  }
   async read(providerId) {
     return providerId === this.providerId ? this.readCurrent() : void 0;
   }
@@ -28171,27 +28503,42 @@ var OAuthCredentialFileStore = class {
     if (providerId !== this.providerId) {
       throw new Error(`${this.label}: credential store does not own provider "${providerId}"`);
     }
-    await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
-    return withFileLock(this.filename, async () => {
-      const current = await this.loadCurrent({ allowUnreadable: true });
-      const candidate = await fn(current);
-      if (candidate === void 0) return current;
-      const document = parseDocument(
-        JSON.stringify({
-          version: AUTH_FORMAT_VERSION,
-          credential: candidate
-        }),
-        this.filename,
-        this.label
-      );
-      await this.assertDestinationReplaceable();
-      await writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}
-`, {
-        mode: 384,
-        dirMode: 448
-      });
-      return cloneCredential2(document.credential);
+    const document = await this.mutateDocument({ allowUnreadable: true }, async (current) => {
+      const active = current === void 0 ? void 0 : activeCredential(current);
+      const candidate = await fn(active);
+      if (candidate === void 0) return UNCHANGED;
+      if (candidate.type !== "oauth") {
+        throw new Error(`${this.label}: ${this.filename} credential type must be oauth`);
+      }
+      if (this.loginPersist !== void 0) {
+        return this.nextDocumentAfterLogin(current, candidate, this.loginPersist);
+      }
+      if (current === void 0) return documentFromCredential(candidate);
+      return withUpdatedActiveCredential(current, candidate);
     });
+    return document === void 0 ? void 0 : activeCredential(document);
+  }
+  /**
+   * Redirect `modify` writes (pi-ai `models.login`) through multi-account upsert
+   * semantics for the duration of `fn`.
+   */
+  async runLoginPersist(options, fn) {
+    if (this.loginPersist !== void 0) {
+      throw new Error(`${this.label}: login persist already in progress`);
+    }
+    this.loginPersist = options;
+    try {
+      return await fn();
+    } finally {
+      this.loginPersist = void 0;
+    }
+  }
+  /** Persist a login/import credential without going through pi-ai `modify`. */
+  async persistLoginCredential(credential, options) {
+    await this.mutateDocument(
+      { allowUnreadable: true },
+      async (current) => this.nextDocumentAfterLogin(current, credential, options)
+    );
   }
   /**
    * Force the next `getAuth()` to refresh by backdating `expires` into the past.
@@ -28216,6 +28563,163 @@ var OAuthCredentialFileStore = class {
     await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
     await withFileLock(this.filename, () => rm(this.filename, { force: true }));
   }
+  /** Read-only account list for Settings / API. Never includes tokens. */
+  async listAccounts() {
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    if (document === void 0) return [];
+    return document.accounts.map(summarizeAccount);
+  }
+  async getActiveAccountId() {
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    return document?.activeAccountId;
+  }
+  /**
+   * Read one account's credential without changing activeAccountId.
+   * Used by the optional quota-aware pool proxy for sticky per-request routing.
+   */
+  async readAccount(id) {
+    if (!isValidAccountId(id)) return void 0;
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    const account = document?.accounts.find((entry) => entry.id === id);
+    return account === void 0 ? void 0 : cloneCredential2(account.credential);
+  }
+  /**
+   * Serialized refresh/write for one account id. Does not move activeAccountId.
+   * Returns undefined when the account is absent (caller treats as missing credential).
+   */
+  async modifyAccount(id, fn) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    const document = await this.mutateDocument({ allowUnreadable: true }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      const index = current.accounts.findIndex((account2) => account2.id === id);
+      if (index < 0) return UNCHANGED;
+      const existing = current.accounts[index];
+      if (existing === void 0) return UNCHANGED;
+      const candidate = await fn(cloneCredential2(existing.credential));
+      if (candidate === void 0) return UNCHANGED;
+      if (candidate.type !== "oauth") {
+        throw new Error(`${this.label}: ${this.filename} credential type must be oauth`);
+      }
+      const accounts = current.accounts.map(cloneAccount);
+      const target = accounts[index];
+      if (target === void 0) return UNCHANGED;
+      accounts[index] = {
+        ...target,
+        credential: cloneCredential2(candidate)
+      };
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: current.activeAccountId,
+        accounts
+      };
+    });
+    if (document === void 0) return void 0;
+    const account = document.accounts.find((entry) => entry.id === id);
+    return account === void 0 ? void 0 : cloneCredential2(account.credential);
+  }
+  async setActiveAccount(id) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) {
+        throw new Error(`${this.label}: no credential accounts are stored`);
+      }
+      if (!current.accounts.some((account) => account.id === id)) {
+        throw new Error(`${this.label}: account "${id}" is not stored`);
+      }
+      if (current.activeAccountId === id) return UNCHANGED;
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: id,
+        accounts: current.accounts.map(cloneAccount)
+      };
+    });
+  }
+  async upsertAccount(input) {
+    if (!isValidAccountId(input.id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    if (input.label !== void 0 && (typeof input.label !== "string" || input.label.length === 0)) {
+      throw new TypeError(`${this.label}: account label must be a non-empty string when present`);
+    }
+    const credential = parseOAuthCredential(input.credential, this.filename, this.label);
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) {
+        return {
+          version: AUTH_FORMAT_VERSION,
+          activeAccountId: input.id,
+          accounts: [
+            {
+              id: input.id,
+              ...input.label === void 0 ? {} : { label: input.label },
+              credential: cloneCredential2(credential),
+              createdAt: Date.now()
+            }
+          ]
+        };
+      }
+      const existingIndex = current.accounts.findIndex((account) => account.id === input.id);
+      if (existingIndex < 0 && current.accounts.length >= MAX_ACCOUNTS) {
+        throw new Error(`${this.label}: at most ${String(MAX_ACCOUNTS)} accounts may be stored`);
+      }
+      const accounts = current.accounts.map(cloneAccount);
+      if (existingIndex >= 0) {
+        const existing = accounts[existingIndex];
+        if (existing === void 0) {
+          throw new Error(`${this.label}: account "${input.id}" is not stored`);
+        }
+        accounts[existingIndex] = {
+          id: input.id,
+          ...input.label !== void 0 ? { label: input.label } : existing.label === void 0 ? {} : { label: existing.label },
+          credential: cloneCredential2(credential),
+          createdAt: existing.createdAt
+        };
+      } else {
+        accounts.push({
+          id: input.id,
+          ...input.label === void 0 ? {} : { label: input.label },
+          credential: cloneCredential2(credential),
+          createdAt: Date.now()
+        });
+      }
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: input.makeActive === true ? input.id : current.activeAccountId,
+        accounts
+      };
+    });
+  }
+  async removeAccount(id) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      const accounts = current.accounts.filter((account) => account.id !== id).map(cloneAccount);
+      if (accounts.length === current.accounts.length) return UNCHANGED;
+      if (accounts.length === 0) return void 0;
+      const fallback = accounts[0];
+      if (fallback === void 0) return void 0;
+      const activeAccountId = current.activeAccountId === id ? fallback.id : current.activeAccountId;
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId,
+        accounts
+      };
+    });
+  }
 };
 var GrokBuildCredentialStore = class extends OAuthCredentialFileStore {
   constructor(filename = grokBuildAuthPath()) {
@@ -28248,85 +28752,9 @@ async function importGrokBuildSession(session, filename) {
   await session.refreshLiveCatalog();
 }
 
-// src/http-json.ts
-var JSON_BODY_LIMIT_BYTES = 64 * 1024;
-var JsonRequestError = class extends Error {
-  statusCode;
-  constructor(statusCode, message) {
-    super(message);
-    this.name = "JsonRequestError";
-    this.statusCode = statusCode;
-  }
-};
-function declaredLength(request) {
-  const value = request.headers["content-length"];
-  if (typeof value !== "string" || !/^\d+$/u.test(value)) return void 0;
-  const length = Number(value);
-  return Number.isSafeInteger(length) ? length : void 0;
-}
-function readJsonRequest(request, limit = JSON_BODY_LIMIT_BYTES) {
-  const length = declaredLength(request);
-  if (length !== void 0 && length > limit) {
-    request.resume();
-    return Promise.reject(new JsonRequestError(413, "request body is too large"));
-  }
-  return new Promise((resolve8, reject) => {
-    const chunks = [];
-    let size = 0;
-    let settled = false;
-    const cleanup = () => {
-      request.removeListener("data", onData);
-      request.removeListener("end", onEnd);
-      request.removeListener("error", onError);
-      request.removeListener("aborted", onAborted);
-    };
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      request.resume();
-      reject(error);
-    };
-    const onData = (value) => {
-      if (settled) return;
-      const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
-      size += chunk.byteLength;
-      if (size > limit) {
-        fail(new JsonRequestError(413, "request body is too large"));
-        return;
-      }
-      chunks.push(chunk);
-    };
-    const onEnd = () => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      const text = Buffer.concat(chunks, size).toString("utf8").trim();
-      if (text.length === 0) {
-        resolve8({});
-        return;
-      }
-      try {
-        resolve8(JSON.parse(text));
-      } catch {
-        reject(new JsonRequestError(400, "request body must contain valid JSON"));
-      }
-    };
-    const onError = () => fail(new JsonRequestError(400, "request body could not be read"));
-    const onAborted = () => fail(new JsonRequestError(400, "request body was aborted"));
-    request.on("data", onData);
-    request.once("end", onEnd);
-    request.once("error", onError);
-    request.once("aborted", onAborted);
-  });
-}
-function requestErrorStatus(error, fallback) {
-  return error instanceof JsonRequestError ? error.statusCode : fallback;
-}
-
 // src/oauth.ts
 import { Buffer as Buffer2 } from "node:buffer";
-import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "node:crypto";
 import { createServer } from "node:http";
 var GROK_BUILD_OAUTH_ISSUER = "https://auth.x.ai";
 var APPROVED_GROK_ISSUER_ORIGIN2 = "https://auth.x.ai";
@@ -28493,12 +28921,12 @@ async function discoverOAuthEndpoints(issuer, signal, options = {}) {
   return parsed;
 }
 function generatePkce() {
-  const verifier = randomBytes2(32).toString("base64url");
+  const verifier = randomBytes3(32).toString("base64url");
   const challenge = createHash2("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function randomToken() {
-  return randomBytes2(16).toString("base64url");
+  return randomBytes3(16).toString("base64url");
 }
 function buildAuthorizeUrl(endpoints, params, redirectUri, challenge, state, nonce) {
   const url = new URL(endpoints.authorization_endpoint);
@@ -28983,6 +29411,14 @@ function waitForPromptAbort(prompt) {
 async function grokImportAvailable() {
   return (await probeGrokAuth()).available;
 }
+async function signedInAccountFields(store) {
+  const accounts = [...await store.listAccounts()];
+  const activeAccountId = await store.getActiveAccountId();
+  if (activeAccountId === void 0 || accounts.length === 0) {
+    throw new Error("signed-in status requires at least one stored account");
+  }
+  return { accounts, activeAccountId };
+}
 var GrokBuildWebAuth = class {
   constructor(session) {
     this.session = session;
@@ -29042,6 +29478,16 @@ var GrokBuildWebAuth = class {
     await this.session.setSelectedModels(ids);
     this.state = await this.readStoredStatus();
   }
+  async setActiveAccount(id) {
+    await this.session.store.setActiveAccount(id);
+    this.session.notifyCredentialChange();
+    this.state = await this.readStoredStatus();
+  }
+  async removeAccount(id) {
+    await this.session.store.removeAccount(id);
+    this.session.notifyCredentialChange();
+    this.state = await this.readStoredStatus();
+  }
   async signOut() {
     this.cancellation?.abort(new Error("grok-build: sign-in cancelled"));
     await this.operation?.catch(() => void 0);
@@ -29159,6 +29605,7 @@ var GrokBuildWebAuth = class {
     if (!stored.authenticated) return { status: "signed-out", grokImportAvailable: grok };
     const available = this.session.availableModels().map((model) => model.id);
     const selected = this.session.selectedModelIds();
+    const accounts = await signedInAccountFields(this.session.store);
     return {
       status: "signed-in",
       models: this.session.visibleModels().map((model) => model.id),
@@ -29166,6 +29613,7 @@ var GrokBuildWebAuth = class {
       selected: selected ?? available,
       catalogSource: this.session.catalogSource,
       grokImportAvailable: grok,
+      ...accounts,
       ...this.session.catalogError === void 0 ? {} : { catalogError: this.session.catalogError }
     };
   }
@@ -29248,6 +29696,16 @@ var SubscriptionWebAuth = class {
     await this.session.setSelectedModels(ids);
     this.state = await this.readStoredStatus();
   }
+  async setActiveAccount(id) {
+    await this.session.store.setActiveAccount(id);
+    this.session.notifyCredentialChange();
+    this.state = await this.readStoredStatus();
+  }
+  async removeAccount(id) {
+    await this.session.store.removeAccount(id);
+    this.session.notifyCredentialChange();
+    this.state = await this.readStoredStatus();
+  }
   async signOut() {
     this.cancellation?.abort(new Error(`${this.session.definition.route}: sign-in cancelled`));
     await this.operation?.catch(() => void 0);
@@ -29280,7 +29738,14 @@ var SubscriptionWebAuth = class {
     const base = this.baseStatus();
     try {
       const stored = await this.session.status();
-      return stored.authenticated ? { ...base, status: "signed-in", ...stored.expiresAt === void 0 ? {} : { expiresAt: stored.expiresAt } } : { ...base, status: "signed-out" };
+      if (!stored.authenticated) return { ...base, status: "signed-out" };
+      const accounts = await signedInAccountFields(this.session.store);
+      return {
+        ...base,
+        status: "signed-in",
+        ...accounts,
+        ...stored.expiresAt === void 0 ? {} : { expiresAt: stored.expiresAt }
+      };
     } catch (error) {
       return { ...base, status: "error", message: safeMessage(error) };
     }
@@ -29660,6 +30125,50 @@ function registerCodingOAuthRoutes(ctx, grokSession, subscriptionSessions, owner
             json(res, requestErrorStatus(error, 500), { error: safeMessage(error) });
           }
         }
+      }),
+      webServer.register({
+        kind: "exact",
+        path: CODING_OAUTH_ACCOUNTS_SET_ACTIVE_PATH,
+        handler: async (req, res) => {
+          if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+          const decision = ownerRequestPolicy.authorize(req);
+          if (!decision.authorized || decision.accessMode === void 0) return json(res, 403, { error: "forbidden" });
+          try {
+            const body = recordBody(await readJsonRequest(req));
+            const slug = providerSlug(body);
+            const accountId = body["accountId"];
+            if (typeof accountId !== "string" || accountId.trim().length === 0) {
+              return json(res, 400, { error: "accountId must be a non-empty string" });
+            }
+            if (slug === "grok") await grok.setActiveAccount(accountId);
+            else await subscription(slug).setActiveAccount(accountId);
+            json(res, 200, await allStatus(decision.accessMode));
+          } catch (error) {
+            json(res, requestErrorStatus(error, 500), { error: safeMessage(error) });
+          }
+        }
+      }),
+      webServer.register({
+        kind: "exact",
+        path: CODING_OAUTH_ACCOUNTS_REMOVE_PATH,
+        handler: async (req, res) => {
+          if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+          const decision = ownerRequestPolicy.authorize(req);
+          if (!decision.authorized || decision.accessMode === void 0) return json(res, 403, { error: "forbidden" });
+          try {
+            const body = recordBody(await readJsonRequest(req));
+            const slug = providerSlug(body);
+            const accountId = body["accountId"];
+            if (typeof accountId !== "string" || accountId.trim().length === 0) {
+              return json(res, 400, { error: "accountId must be a non-empty string" });
+            }
+            if (slug === "grok") await grok.removeAccount(accountId);
+            else await subscription(slug).removeAccount(accountId);
+            json(res, 200, await allStatus(decision.accessMode));
+          } catch (error) {
+            json(res, requestErrorStatus(error, 500), { error: safeMessage(error) });
+          }
+        }
       })
     ]);
     return releaseRoutes;
@@ -30589,14 +31098,14 @@ function createCodexImageController(options) {
   };
 }
 
-// src/grok-imagine.ts
+// src/grok-imagine/client.ts
 var import_undici2 = __toESM(require_undici());
 import { Buffer as Buffer3 } from "node:buffer";
 import { lookup as dnsLookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
+import { isIP as isIP2 } from "node:net";
 
 // src/media-store.ts
-import { createHash as createHash3, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { chmod, link, lstat as lstat2, mkdir as mkdir2, open as open2, readdir, unlink } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute, join as join4, relative, resolve as resolve4, sep } from "node:path";
@@ -30629,7 +31138,7 @@ function sha256Hex(data) {
   return createHash3("sha256").update(data).digest("hex");
 }
 function generateArtifactId() {
-  return randomBytes3(16).toString("hex");
+  return randomBytes4(16).toString("hex");
 }
 function clampPositive(value, ceiling, label) {
   const raw = value ?? ceiling;
@@ -30816,7 +31325,7 @@ async function writeExclusiveFile(root, path, data) {
     throw collision;
   }
   const payload = typeof data === "string" ? Buffer.from(data) : data;
-  const temporary = join4(dirname2(target), `.tmp-${randomBytes3(8).toString("hex")}`);
+  const temporary = join4(dirname2(target), `.tmp-${randomBytes4(8).toString("hex")}`);
   const handle = await openNoFollow(
     temporary,
     fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,
@@ -31330,7 +31839,10 @@ var MediaStore = class {
   }
 };
 
-// src/grok-imagine.ts
+// src/grok-imagine/net.ts
+import { BlockList, isIP } from "node:net";
+
+// src/grok-imagine/types.ts
 var XAI_API_ORIGIN = "https://api.x.ai";
 var GROK_IMAGINE_IMAGE_PATH = "/v1/images/generations";
 var GROK_IMAGINE_VIDEO_START_PATH = "/v1/videos/generations";
@@ -31387,6 +31899,8 @@ var IMAGE_RESOLUTION_SET = new Set(IMAGINE_IMAGE_RESOLUTIONS);
 var VIDEO_RESOLUTION_SET = new Set(IMAGINE_VIDEO_RESOLUTIONS);
 var IMAGE_ASPECT_SET = new Set(IMAGINE_IMAGE_ASPECT_RATIOS);
 var VIDEO_ASPECT_SET = new Set(IMAGINE_VIDEO_ASPECT_RATIOS);
+
+// src/grok-imagine/net.ts
 var blockedNetworks = new BlockList();
 blockedNetworks.addSubnet("0.0.0.0", 8, "ipv4");
 blockedNetworks.addSubnet("10.0.0.0", 8, "ipv4");
@@ -31418,16 +31932,6 @@ blockedNetworks.addSubnet("5f00::", 16, "ipv6");
 blockedNetworks.addSubnet("fc00::", 7, "ipv6");
 blockedNetworks.addSubnet("fe80::", 10, "ipv6");
 blockedNetworks.addSubnet("ff00::", 8, "ipv6");
-function isRecord5(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function redactImagineMessage(error) {
-  const withoutRemoteUrls = (error instanceof Error ? error.message : String(error)).replace(
-    /https?:\/\/[^\s"'<>\\]+/giu,
-    "[redacted-url]"
-  );
-  return safeMessage(withoutRemoteUrls);
-}
 function dottedFromWords(high, low) {
   return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
 }
@@ -31520,6 +32024,18 @@ function isBlockedHostname(hostname) {
 function isAllowlistedImagineHost(hostname) {
   return FROZEN_OUTPUT_HOSTS.has(normalizeHostname(hostname));
 }
+
+// src/grok-imagine/parse.ts
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function redactImagineMessage(error) {
+  const withoutRemoteUrls = (error instanceof Error ? error.message : String(error)).replace(
+    /https?:\/\/[^\s"'<>\\]+/giu,
+    "[redacted-url]"
+  );
+  return safeMessage(withoutRemoteUrls);
+}
 function grokImagineVideoStatusPath(requestId) {
   if (!VIDEO_REQUEST_ID_PATTERN.test(requestId)) {
     throw new GrokImagineError("INVALID_INPUT", "video request id is not a safe identifier");
@@ -31614,6 +32130,20 @@ function detectVideoMediaType(data) {
   }
   return void 0;
 }
+function parseVideoRequestId(value) {
+  if (typeof value !== "string") {
+    throw new GrokImagineError("INVALID_INPUT", "video request id must be a string");
+  }
+  if (!VIDEO_REQUEST_ID_PATTERN.test(value)) {
+    throw new GrokImagineError(
+      "INVALID_INPUT",
+      "video request id must match ^[A-Za-z0-9_-]{1,256}$ and be a safe ASCII identifier"
+    );
+  }
+  return value;
+}
+
+// src/grok-imagine/client.ts
 function parseContentType(value) {
   if (value === null || value === void 0 || value.trim() === "") return void 0;
   return value.split(";", 1)[0]?.trim().toLowerCase();
@@ -31639,7 +32169,7 @@ async function assertSafeRemoteMediaUrl(raw, lookup) {
     throw new GrokImagineError("SSRF", "generated media URL must use port 443");
   }
   const host = normalizeHostname(url.hostname);
-  if (host === "" || isBlockedHostname(host) || isIP(host) !== 0) {
+  if (host === "" || isBlockedHostname(host) || isIP2(host) !== 0) {
     throw new GrokImagineError("SSRF", "generated media host is not allowed");
   }
   if (!isAllowlistedImagineHost(host)) {
@@ -31658,7 +32188,7 @@ async function assertSafeRemoteMediaUrl(raw, lookup) {
 }
 async function resolvePublicAddresses(hostname, lookup) {
   const host = normalizeHostname(hostname);
-  if (host === "" || isBlockedHostname(host) || isIP(host) !== 0) {
+  if (host === "" || isBlockedHostname(host) || isIP2(host) !== 0) {
     throw new GrokImagineError("SSRF", "host is not allowed");
   }
   const addresses = [...await lookup(host)];
@@ -31671,7 +32201,7 @@ async function resolvePublicAddresses(hostname, lookup) {
 function createPinnedAgent(hostname, addresses) {
   const expected = normalizeHostname(hostname);
   const records = addresses.map((address) => {
-    const family = isIP(address);
+    const family = isIP2(address);
     if (family !== 4 && family !== 6) {
       throw new GrokImagineError("SSRF", "pinned address is not a valid IP");
     }
@@ -31926,18 +32456,6 @@ function requirePrompt(prompt) {
   }
   return prompt;
 }
-function parseVideoRequestId(value) {
-  if (typeof value !== "string") {
-    throw new GrokImagineError("INVALID_INPUT", "video request id must be a string");
-  }
-  if (!VIDEO_REQUEST_ID_PATTERN.test(value)) {
-    throw new GrokImagineError(
-      "INVALID_INPUT",
-      "video request id must match ^[A-Za-z0-9_-]{1,256}$ and be a safe ASCII identifier"
-    );
-  }
-  return value;
-}
 var ImagineAbortError = class extends Error {
   name = "ImagineAbortError";
   constructor(reason) {
@@ -33420,7 +33938,6 @@ var DSH_EXACT_BOM = Object.freeze({
   "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
   "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
   "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-  "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
   "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
   "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
   "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
@@ -33562,7 +34079,7 @@ function createDshHostAdapter(context) {
 }
 
 // src/gateway-auth.ts
-import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 import { mkdir as mkdir3 } from "node:fs/promises";
 import { dirname as dirname3, join as join5, resolve as resolve5 } from "node:path";
 import { writeFileAtomic as writeFileAtomic3 } from "@deepseek-ai/dsh-atomic-write";
@@ -33572,7 +34089,7 @@ function gatewayKeyPath(dshHome) {
   return resolve5(join5(resolveDshHome2(dshHome), GATEWAY_KEY_FILENAME));
 }
 function generateGatewayApiKey() {
-  return randomBytes4(32).toString("base64url");
+  return randomBytes5(32).toString("base64url");
 }
 function gatewayKeysEqual(left, right) {
   const a = Buffer.from(left);
@@ -33628,11 +34145,6 @@ async function persistGatewayKeyDocument(path, document) {
 `, { mode: 384 });
 }
 
-// src/gateway-protocol.ts
-function isThinkingLevel(value) {
-  return value === "off" || value === "minimal" || value === "low" || value === "medium" || value === "high" || value === "xhigh" || value === "max";
-}
-
 // src/gateway-backend.ts
 var GatewayRequestError = class extends Error {
   constructor(status, code, message) {
@@ -34645,6 +35157,17 @@ function createCodingOAuthGatewayController(options) {
 }
 
 // src/gateway-routes.ts
+function authorizeGatewayControl(req, ownerRequestPolicy) {
+  return ownerRequestPolicy.authorize(req);
+}
+function authorizeGatewaySecret(req, ownerRequestPolicy) {
+  const decision = ownerRequestPolicy.authorize(req);
+  if (!decision.authorized) return decision;
+  if (decision.accessMode !== "loopback") {
+    return { authorized: false, reason: "loopback-only" };
+  }
+  return decision;
+}
 function registerGatewayRoutes(ctx, controller, ownerRequestPolicy = LOOPBACK_OWNER_REQUEST_POLICY) {
   let dispose = () => void 0;
   ctx.effect(() => {
@@ -34670,7 +35193,7 @@ function registerGatewayRoutes(ctx, controller, ownerRequestPolicy = LOOPBACK_OW
   return () => dispose();
 }
 async function handleGatewaySettings(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewayControl(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }
@@ -34715,7 +35238,7 @@ async function handleGatewaySettings(req, res, controller, ownerRequestPolicy) {
   }
 }
 async function handleGatewayReveal(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewaySecret(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }
@@ -34730,7 +35253,7 @@ async function handleGatewayReveal(req, res, controller, ownerRequestPolicy) {
   }
 }
 async function handleGatewayRotate(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewaySecret(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }
@@ -35459,6 +35982,10 @@ var OAuthProviderSession = class {
   async invalidateAccessToken() {
     await this.store.invalidate(this.definition.nativeProviderId);
   }
+  /** Refresh host discovery after an account switch/remove without a full logout. */
+  notifyCredentialChange() {
+    this.onCatalogChange?.();
+  }
   async storedCredential() {
     const credential = await this.store.read(this.definition.nativeProviderId);
     return credential?.type === "oauth" ? credential : void 0;
@@ -35623,6 +36150,10 @@ var GrokBuildSession = class {
   async invalidateAccessToken() {
     await this.store.invalidate(XAI_PI_PROVIDER);
   }
+  /** Refresh host discovery after an account switch/remove without a full logout. */
+  notifyCredentialChange() {
+    this.onCatalogChange?.();
+  }
   async logout() {
     try {
       await this.store.delete(XAI_PI_PROVIDER);
@@ -36105,6 +36636,7 @@ export {
   KIMI_CODE_OAUTH_ROUTE,
   KIMI_PI_PROVIDER,
   LOOPBACK_OWNER_REQUEST_POLICY,
+  OAUTH_MAX_ACCOUNTS,
   OAUTH_PROVIDER_DEFINITIONS,
   OAuthCredentialFileStore,
   OAuthProviderSession,
@@ -36143,6 +36675,7 @@ export {
   importGrokBuildFromGrok,
   importGrokBuildSession,
   inject,
+  isValidAccountId,
   loginGrokBuild,
   loginGrokBuildPkce,
   loginGrokBuildSession,
@@ -36161,6 +36694,7 @@ export {
   refreshGrokBuildToken,
   registerCodingOAuthRoutes,
   registerGrokBuildAuthRoutes,
+  resolveAccountIdForCredential,
   resolveOAuthParams,
   safeMessage,
   thinkingLevelMapFromLiveEfforts